a199d0db18680b483518261c47461bcc862364211a0d89e344f1fefb70940092

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Meritrust CU/done.html
Size 4KB
Sample261001-ppvxvsxwft
SHA256 a199d0db18680b483518261c47461bcc862364211a0d89e344f1fefb70940092
MD5 7f51861627e2626b3d11e53611d73b06
SHA1 eabb5ebcc78267dfb89991bf1c0984d6c034ee60
SHA512 7bbb05648503572448a9dfb2711b77d2acd993eff3a5344e100cde32cbabe926266c7e01d7c31fd02ac34b08898bc30fc32e3734972625454e70990752f7e9bc
SSDEEP 96:ASfNmB0T725OY698XVA/pIqaLHVqGFSAo0dLL2z9ES/:A0muucdUVguHV8A112N/
TLSH
T17AA1202AA64618067633D6F86F22170AEBC24413C34252793EDC639B5FFA355D663BCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
141	ipapi.co
142	ipapi.co
148	ipapi.co

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4192	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{824EF9B1-3FA6-4D06-BF73-3C6417A67DEB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe
5636	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 5636 wrote to memory of 4564	5636	msedge.exe	89
PID 5636 wrote to memory of 2636	5636	msedge.exe	90
PID 5636 wrote to memory of 4192	5636	msedge.exe	91
PID 5636 wrote to memory of 2636	5636	msedge.exe	90
PID 5636 wrote to memory of 2636	5636	msedge.exe	90
PID 5636 wrote to memory of 4664	5636	msedge.exe	92
PID 5636 wrote to memory of 4664	5636	msedge.exe	92
PID 5636 wrote to memory of 2556	5636	msedge.exe	94
PID 5636 wrote to memory of 3308	5636	msedge.exe	95
PID 5636 wrote to memory of 2556	5636	msedge.exe	94
PID 5636 wrote to memory of 2556	5636	msedge.exe	94
PID 5636 wrote to memory of 3308	5636	msedge.exe	95
PID 5636 wrote to memory of 3308	5636	msedge.exe	95
PID 5636 wrote to memory of 2040	5636	msedge.exe	96
PID 5636 wrote to memory of 2040	5636	msedge.exe	96
PID 5636 wrote to memory of 2040	5636	msedge.exe	96
PID 5636 wrote to memory of 696	5636	msedge.exe	97
PID 5636 wrote to memory of 696	5636	msedge.exe	97
PID 5636 wrote to memory of 696	5636	msedge.exe	97
PID 5636 wrote to memory of 1976	5636	msedge.exe	99
PID 5636 wrote to memory of 1060	5636	msedge.exe	100
PID 5636 wrote to memory of 1976	5636	msedge.exe	99
PID 5636 wrote to memory of 1060	5636	msedge.exe	100
PID 5636 wrote to memory of 5884	5636	msedge.exe	102
PID 5636 wrote to memory of 4680	5636	msedge.exe	105
PID 5636 wrote to memory of 4680	5636	msedge.exe	105
PID 5636 wrote to memory of 4680	5636	msedge.exe	105
PID 5636 wrote to memory of 4276	5636	msedge.exe	106
PID 5636 wrote to memory of 4276	5636	msedge.exe	106
PID 5636 wrote to memory of 4276	5636	msedge.exe	106
PID 5636 wrote to memory of 4496	5636	msedge.exe	107
PID 5636 wrote to memory of 4496	5636	msedge.exe	107
PID 5636 wrote to memory of 4496	5636	msedge.exe	107
PID 5636 wrote to memory of 1552	5636	msedge.exe	108
PID 5636 wrote to memory of 1552	5636	msedge.exe	108
PID 5636 wrote to memory of 1552	5636	msedge.exe	108
PID 5636 wrote to memory of 1092	5636	msedge.exe	110
PID 5636 wrote to memory of 2572	5636	msedge.exe	111
PID 5636 wrote to memory of 4092	5636	msedge.exe	112
PID 5636 wrote to memory of 5140	5636	msedge.exe	113
PID 5636 wrote to memory of 5140	5636	msedge.exe	113
PID 5636 wrote to memory of 1500	5636	msedge.exe	115
PID 5636 wrote to memory of 4160	5636	msedge.exe	116
PID 5636 wrote to memory of 4160	5636	msedge.exe	116
PID 5636 wrote to memory of 4160	5636	msedge.exe	116
PID 5636 wrote to memory of 2532	5636	msedge.exe	117
PID 5636 wrote to memory of 2532	5636	msedge.exe	117
PID 5636 wrote to memory of 2532	5636	msedge.exe	117
PID 5636 wrote to memory of 5032	5636	msedge.exe	118
PID 5636 wrote to memory of 5032	5636	msedge.exe	118
PID 5636 wrote to memory of 5032	5636	msedge.exe	118
PID 5636 wrote to memory of 4888	5636	msedge.exe	119
PID 5636 wrote to memory of 4888	5636	msedge.exe	119
PID 5636 wrote to memory of 4888	5636	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Meritrust CU\done.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffe8f65c188,0x7ffe8f65c194,0x7ffe8f65c1a0
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,12082896957442319248,14360699548967413128,262144 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,5793933083282882168,14231985521230486379,524288 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,9253042989168181366,13800424440273937675,524288 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:13
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,9245422419741140225,666105640371237892,2097152 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,16082105209647033514,744204761738423989,2097152 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4400,i,13238082214049458765,15307003122913341506,2097152 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:9
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,5729288094526403862,11233679249353359066,2097152 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,4569189576131634642,3786387816104757972,524288 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,6469493445798369085,1965503615504333087,524288 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,14792690787572573530,16102552700075569132,524288 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:14
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,14792690787572573530,16102552700075569132,524288 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:14
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6544,i,44947780956068932,9903805967171056218,2097152 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5336,i,6937305796262769081,3272252443600527952,2097152 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3708,i,9959444446640219918,10263184056087467948,2097152 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4412,i,1438903940518706453,13516477873612780191,2097152 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,7425860329435875602,16405945551067875766,524288 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,11294474401618938951,452587448687823351,524288 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,4229967436003645305,1014094178093652467,524288 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2860,i,10134141126719759427,4005753635676664513,524288 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=816,i,16115675443772760647,6175731271335773006,262144 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=812 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4384,i,5946209238250127052,7614682339457164622,2097152 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6208,i,477507080108148264,17654200536802080380,2097152 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5200,i,12878868343190416543,3359273138955741225,2097152 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5568,i,12716664789425547868,5948496523854410329,2097152 --field-trial-handle=2316,i,9580374050022392862,14207714049620272989,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 aedd360b7640117a18dcff690594fd92293bed69ed163064263716235eb5805c
MD5 4bd99848988c7ffa4d15ee827acbab27
SHA1 b60a363c5050f47f18d43b5c7c6521901ddcb2be
SHA512 1cab8eb707cd12d4710f551a7f3089625dc1bad26d82ef9e98025b83f1d6e99383a568651a3cb196dc9249a9351e15cab459cc2a7f471b74d1fc0eef83bd6ca9
TLSH
T1B3210C83CAA81085F381B634D7C533373AF4F98D45435E410A94C8B5B98A79C7055F7C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d016afdc856c07901a32e189111893491010f2a308757339b72b62584ccc8748
MD5 4701b835721364eacf9ada03d966cb95
SHA1 6ee2ea2f8ba84527a9bfac335b7f594b150e946b
SHA512 a80ff4741c66b0e4c482546d780cc8ec278e916305ab7b1b461390a7bc5bc2ec4cdf8d6e67ecdba06f34a4272d43594f81df6bf9b4328b81c626a1c67e16f6dd
TLSH
T1E17192F7C7E8866E890156F0AB146E2BCE2D4515432C3C6B89E49F5F93E28B1E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8e584455b7c10c95d0003b47b8899331f7a7d4b326764247f2a1712fa587c79e
MD5 cf1518c25b48256b2f5c6d9ae82035cf
SHA1 e68fa755bb730db2d351644dc5f950bb7e8220c9
SHA512 0273f9007aaa96192f36063ff97e0c35365decf4b39e741da84e937e79d74e8e9b09a8550c4610e19475af4aba661a0ae56e194061f19618727da1caaec66431
SSDEEP 192:sxRmRmb+/fis7JHRQ+zoA8p0SL5/g6+WNIYEzYGJIgD7J:sxRmq+/fisVMH/5IpB
TLSH
T19142B815AD28A97B9CCBE21DBB55BF53E3F96032A1901E48B6FC861C04E76DD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e6ed7f484d6df6b6bb4805529ad9049f51a8a1dc01d6e8a342b5a64a4624f06b
MD5 7035b3c29cc496f400e679aa04d9c61b
SHA1 270f19a0ea32de6c72052098281707975e8627ce
SHA512 14c69a5c0f858ee9359b89ac8aa699d99b06deb6f9ad0eb3124d5c26a6c0a72065fab27622d361ab108f9f398828307491d493811f6cf6507c2789dacf07bc98
SSDEEP 192:sxRmRmb+/fis7JHR2+zoA8pGSLL/g6+WNIYEzYGJIgD7J:sxRmq+/fisVKL/5IpB
TLSH
T16142B815AD24A97B5CCBE20DBB55BF53E3F96032A1901E48B6FC861C04E76DD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 90408447bc62e170768b84f2c54609e00ac3f282ccb4ee6ae8d2f16cc7c8558f
MD5 35d91f7cb5907ecace9ad7e646ccab39
SHA1 940f042474d33f22b31a9661d8a4f0a159d59d85
SHA512 384fe9f5e84d273604c880070c82bd41b6aa84f564719f5b4316aa465a60bf2cbc2159709427ef507ad2166329d00382310b13d34c5e3920d93997566e33efbe
SSDEEP 192:sxRxRmb+/fishHR2+zoA8pGSLL/g6+WNIYEIYGJIgIJ:sxRxq+/fishKL/5Iqs
TLSH
T15632B715AD28A97B4CCBD21DBB65BF53D3F96032A1901E48F6FC861C04E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8446a165a46a633e273edf2cea201647c6979e610bdab2c58ec3e2056c407b17
MD5 f1cecc033617c41a7f5528339a51072b
SHA1 1f4d6334eb35d30cfd84a65fdcdcf3e760bee282
SHA512 bcb12c73131b2afd0b0d29128b5ef8f788e77cef35d557992ae7218bf252ccda34a4aaf051b91a774104f333708749b9d4e059985f53a9de6b95017ecca5e23e
SSDEEP 192:sxRmRmb+/fis7LHR2+zoA8pGSLL/g6+WNIYEIYGJIgD1J:sxRmq+/fisfKL/5IqD
TLSH
T11642A715AD28A97B4CCBD21DBB55BF53E7F96032A1901E48B6FC8A1C04E76DD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 b94a0830fa099c9fda55455d8afc87f3b7a95492baa2c98bb29f71d824f4258e
MD5 5fdf98469ff901fb50cb08767284eedb
SHA1 30650da83206a2ac5dae40a51c0390f4ec66ef9f
SHA512 c498aa3859c8ceb242ca3c80379693bf1b8263a43bc2589dacb2adb7204e50486b00f209fa0ae57165a61d167f425c8c393ffc6206c404fea28240caa8828392
SSDEEP 384:USupCD0fCtg82Ff3LKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVQc9hnRXHroJeD:U/pCDmWg8Kf3L8F1+UoAYDCx9Tuqh0Vy
TLSH
T15EB2D92B600CCB7E4FC04A9EA8197FD77D9802CB9A588D4047FE995C02C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7bd1e5eb089b8489053c4af1bb65a481120c6a885e93df1e90e224a21d9d417c
MD5 0b1a7f2049234cf9d162506516ead21d
SHA1 91079af0b95962390775c6e93fab01bd816a24b8
SHA512 1e472e3867e4ce3e5f2f5abd974292f3be39dc761864ffda27bcd8089a5659cbf57592026aae14d8bfdd33df4adffb7e284064551d07b572c50f35e07438835b
SSDEEP 48:KiaSS+givlIxA+KyLKW+eYuHXGQfyZsIDKF6cTyFPsr/dhFkVhCPICHkKDBLlk3G:KcjyKo4CasQKF6iKEgK9mGz
TLSH
T1F491EF05726E420138BF3A4A81B5872B524131B77158E63B7FBD10668E67E146EFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1241.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1241.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 74cc1d5c222038916dad84d70904372ee7384735e63b1e7388688fbc9aa9d8df
MD5 1cd2cc36092664e25a53d2fac5cdbd53
SHA1 2c0d2fca4b406a768741347915250bd83c3facc3
SHA512 621c8ff6f8ac6961e8e90be81904bff3761e1525249dff89b099bcf893b705cf341ae9c7ea1eef90959f9ce2ba1edb87964261a79450c563ab208e306365222b
SSDEEP 768:5+3eNNc7fZrKREb1tlp5XSwQs88uBkiT2p2stpl:5+3eAtrZbILNBY2sXl
TLSH
T100F2B035EC9099B3ACF693C67B8A37022FF0A147D4C80654C9DE661E02877AE174B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 523f59bce9568c8250cb82c9c9019fb2460dd7be4ae73c13e3ec4e1d06657b8d
MD5 fb46546d5df64b9bba8b9cb9ef6e17ac
SHA1 36037df09dea2e046ce6718456eb9e14caafe9fb
SHA512 aa0771f0fea452dae7fd750666901ce7376f5fc261d76288e84ac6639e6865d1344e47f9f9cfd538e5a329d918bf65c1906bec15dfa564f83df8a5cd855a440f
SSDEEP 768:eFQQ3xwgtPNc7fZrKREb1t0Sp5XSwQs88uBkiT2p2stpl:1Q3dmtrZksILNBY2sXl
TLSH
T1761347F298C38476E8AE8783AB7E2E025EBCD043B4844644B7D9511DCD472BFC30B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 1e2aa1c65ba11479752ba61cf35c255e321102bae1fce5a855e6d2b1386d4cef
MD5 242ae09f6cdd22582fb07c3cb1a408bd
SHA1 ecfbacbb08060770cbef1c7912da73e0b78e238b
SHA512 641153f65e78c9cc7781f21090dfd7cedf739181f1a7d9c82e15e2c6c04ad2591e8596b8207f1a479701a6aac20eef92dd61b9d432b73a0041b4385052810ee0
SSDEEP 768:R/UxvxjgC+W3TCpvc7fZrKRIp5XSwQs88uBkiTCd/P84g:kZj3+W3umtrtILNBsHg
TLSH
T15603C039EC946873ACB79385375A275BAFF06053C4C41B984AEE7A0E038B75D6307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b796f0d3db033d8fa075e8e27d43adeca6af2f7b437a945d533ffce8636d3562
MD5 ce6c7cb5fc6cbf18c7a21b391a4a7ac1
SHA1 defaed473fc2736d9fc630417480c2531457fbb5
SHA512 77a2359e7ea6256b241f853a0bf91350a08d15095d6ee8d601f838eea22cc5289a4d20dbfb68f34f15b896298b2ac2f171516f6afdd8f0b772f26bdaa062d5c3
SSDEEP 768:w+3zbNc7fZrKREb1tlp5XSwQs88uBkiT2p2stpl:w+3zatrZbILNBY2sXl
TLSH
T16FF2B035EC9099B3ACF693C67B4A37026FF0A147D4C80654C9EE671E02877AE174B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/5884-181-0x000001B7EF1C0000-0x000001B7EF401000-memory.dmp

Download